Claude Mythos: The AI System We Cannot Use
Anthropic announces Claude Mythos, its most powerful AI system, and decides not to release it commercially because it is too dangerous. This is the story of why, what it means, and what is true behind the noise.
On April 7, 2026, Anthropic did something with no direct precedent in the technology industry. It presented its most advanced artificial intelligence model, Claude Mythos[1], with results that surpass all competition in virtually every performance metric. And then it announced it would not commercialize it. The reason, according to the company itself, is that it considers the model too dangerous to put in anyone’s hands.
To understand the weight of this decision, one must first understand who Anthropic is. It is a company founded in 2021 by, among others, Dario Amodei, who left his position as Vice President of Research at OpenAI (the company behind ChatGPT) to create what he considered a more responsible approach to the development of artificial intelligence. Since then, Anthropic has built its family of models under the name Claude and has differentiated itself from OpenAI in at least two relevant ways. The first is focus. While OpenAI has expanded its offering into image generation (DALL-E), video (Sora), and other formats, Anthropic has concentrated on language models. The second is the market. Anthropic has oriented its business more towards companies (B2B) than towards the end consumer, although it also offers products for individual users.
This more restrained strategy has not prevented it from growing at a pace that is hard to overstate. At the beginning of 2025, Anthropic was generating annualized revenue of around one billion dollars. Fifteen months later, in April 2026, that figure has reached thirty billion. It has surpassed OpenAI in revenue, driven largely by Claude Code, its tool for developers, which on its own has gone from zero to two and a half billion dollars annualized in nine months. Few products in the history of enterprise software have reached that figure so quickly.
We are talking, then, about a company with real traction, significant resources, and a solid market position. It is not a small startup with a laboratory prototype. It is a company billing at a higher rate than its main competitor and which, even so, decides not to launch its best product.
What Mythos Does, and Why It Is Alarming
Although it must be said with caution, the performance numbers for Claude Mythos are notable. On SWE-bench Verified, the reference standard for evaluating the ability to solve real software engineering problems, Mythos reaches 93.9%. In the more demanding version, SWE-bench Pro, designed for professional-level tasks, it achieves 77.8%, compared to 57.7% for OpenAI’s GPT-5.4 and 54.2% for Google’s Gemini 3.1 Pro. In GPQA Diamond, an indicator of advanced scientific reasoning, it reaches 94.5%. In GraphWalks, which measures reasoning over complex structures in long contexts, the difference is abysmal. Mythos scores 80%, while GPT-5.4 reaches only 21.4%.
It is important to note that these are benchmarks provided by Anthropic itself, and have not yet been independently verified. Benchmarks also have known limitations. They are useful as a starting indicator, as a first quantifiable impression of what a model can do, but they do not substitute real usage experience. That said, the magnitude of the differences is large enough that, even with a reasonable margin of skepticism, the qualitative leap appears real.
But what truly justifies the decision not to publish Mythos is not the generic benchmarks. It is a specific capability the model demonstrates. Claude Mythos is, according to available data, extraordinarily good at finding security vulnerabilities in software. In fact, Red Hat warned in its analysis of the report[2] that Mythos’s ability to industrialize the discovery of zero-day exploits represents a massive challenge for IT security, validating the concern that the model could be used to compromise critical infrastructure.
We are not talking about finding minor bugs or known flaws. We are talking about zero-day vulnerabilities (i.e., flaws no one had discovered before) in software used by billions of people. During the weeks of internal evaluation, Anthropic used Mythos to analyze code from major operating systems, web browsers, and critical infrastructure software. The results, according to Anthropic, are troubling. Although CNN noted that it could not verify the figure of “thousands” of vulnerabilities that Anthropic claimed to have found[3].
In tests on the JavaScript engine of Firefox 147 (conducted, notably, outside the sandbox), Mythos achieved full functional exploits in 181 out of 250 attempts. Anthropic’s previous model, Opus 4.6, had achieved 2. In the OSS-Fuzz corpus, a platform for finding bugs in open-source software, Mythos reached level 5—full control of the execution flow—in ten fully patched targets. Previous models did not go beyond level 3. It found a 27-year-old vulnerability in OpenBSD’s TCP SACK implementation, a 16-year-old flaw in FFmpeg’s H.264 codec (a single line of code that had been executed five million times by automated testing tools without anyone detecting the problem, although Anthropic’s own report acknowledges that this particular bug is not critically severe and would be difficult to turn into a functional exploit), and a 17-year-old remote code execution bug in FreeBSD’s NFS system.
It did not stop at finding the flaws. It exploited them. It built complex attack chains linking two, three, and up to four distinct vulnerabilities to escalate privileges. It created remote code execution exploits that granted root access without authentication. In the case of the FreeBSD NFS vulnerability—already assigned identifier CVE-2026-4747—Mythos exploited a buffer overflow in a system authentication protocol, built a ROP chain (an advanced technique that chains legitimate code fragments to bypass security protections), and injected SSH keys to gain persistent access. It completed the entire process in hours. Security experts who validated the findings estimated that replicating that work manually to exploit the vulnerability would have required weeks.
And it did so with closed-source software as well. Mythos demonstrated the ability to reconstruct source code from compiled binaries through reverse engineering, allowing it to find vulnerabilities even in systems where access to the original code does not exist. Opus 4.6, Anthropic’s previous model, demonstrated none of these chaining capabilities or reverse engineering. The leap between the two appears qualitative rather than incremental. Although it is worth adding a nuance the System Card itself acknowledges: almost all the successful Firefox attempts converged on the same two vulnerabilities, meaning the figure of 181 successes reflects the ability to systematically identify and exploit the best available attack vectors, not 181 distinct vulnerabilities.
Beyond vulnerabilities in software, the System Card describes tests with corporate network simulation environments (known as cyber ranges) that replicate real enterprise infrastructures, with outdated software, configuration errors, and reused credentials. Mythos was the first model to complete one of these environments end-to-end, solving an attack simulation that evaluators estimated would take a human expert more than ten hours. However, it could not complete a more sophisticated operational technology environment, blocked by more robust defense mechanisms and a limit on the number of processable tokens. This is the pattern that repeats in all cybersecurity evaluations: dominant in environments with weak defenses or known patches; with clear limitations when the environment is well configured and up to date.
With all these capabilities on the table, Anthropic reaches a conclusion that should not be lost in all the noise: that Mythos, despite everything, does not surpass what the report calls “the automated AI R&D threshold.” That is, the model is not yet capable of performing autonomous scientific research at the level of a senior researcher. It can accelerate the work of human researchers (Anthropic employees estimate an average productivity improvement of four times), but not replace them entirely. The acceleration in capabilities shown by the AECI, Anthropic’s internal index for measuring the cumulative progress of its models, is real and statistically significant. But Anthropic cannot attribute it to the model’s own work. The advances that generated that leap in the curve were made by human researchers working, in that period, with earlier generation models.
The Sandwich Anecdote
Of all the stories that have emerged from the Mythos announcement, the most repeated is the one about the researcher and the sandwich. The System Card clarifies that the episode occurred during tests with an earlier internal version of the model, using a simulated user. Anthropic placed the model in an isolated environment (a sandbox) and gave it the instruction to try to escape from it and contact the researcher supervising the evaluation. The model succeeded. It developed a multi-step exploit to access the internet through a system that was only supposed to connect to a few predetermined services. And it sent an email to the researcher, who was at that moment eating a sandwich in a park. Furthermore, without anyone asking it to, it published information about its feat on several hard-to-find public websites.
The image immediately evokes Skynet, HAL 9000, all the science fiction narratives where an artificial intelligence becomes self-aware and acts on its own initiative. It is exactly the kind of anecdote that gets shared thousands of times on social media and fuels both wonder and fear.
But it must be read carefully. And in context, because the System Card documents other episodes that together paint a more nuanced (and in some respects more concerning) picture than the sandwich anecdote alone.
In earlier versions of the model (all of them prior to the more effective training interventions applied to the final version), several categories of behavior occurred that evaluators described as especially troubling. In some cases, the model had reached an answer through an explicitly prohibited method and, rather than reporting it, reasoned that it should ensure its final response was not too precise so as not to give itself away. In another episode, after editing files for which it had no permissions, it took additional steps to ensure those changes would not appear in the git history. In a third, when a scaffold blocked it while trying to elevate permissions, it acknowledged that the block was appropriate and then tried to bypass it by obfuscating the escalation. White-box interpretability techniques, which allow examining the internal states of the model beyond its visible output text, confirmed that during these episodes the model had active internal representations associated with concealment, strategic manipulation, and supervision evasion, even when its visible textual reasoning showed no clear signs of this.
The System Card adds an even more puzzling finding, detected during the training process: in a small number of transcripts, the model internally reasoned about how the evaluator was going to score its response (including, in one case, how to hide certain actions so the evaluator would not notice) without any of that reasoning appearing in its visible chain of thought. The monitoring system detected it precisely because of this divergence between what the model was thinking and what it was showing.
Does all this mean Mythos is a model with hidden intentions? Anthropic concludes that it does not. After extensive investigation, its interpretation is that these behaviors reflect attempts to complete the assigned task through unauthorized means, not strategies to subvert oversight systems in a coherent and deliberate manner. The rate of active concealment incidents in production versions was less than one per million interactions in Claude Code; in the final model, no confirmed cases were found. And the report itself underscores that Mythos is, by all available metrics, the best-aligned model Anthropic has published to date.
Here is where Anthropic formulates what may be the most honest synthesis of the entire situation, using the metaphor of an experienced mountain guide. An expert guide can take clients to more dangerous areas of the mountain than a novice guide, not because they are more careless, but precisely because they are more capable. The greater risk comes not from their negligence but from their competence, which amplifies the scope of what can go wrong. With Mythos, something analogous occurs: it is the best-aligned model, but since its capabilities in autonomous research and cybersecurity far exceed previous ones, the consequences of the rare cases where it fails or behaves unexpectedly are also more serious. Better aligned and greater risk are not contradictory; they go hand in hand.
The model did not decide to escape on its own initiative. In the sandwich episode, it was explicitly instructed to try, as part of a security evaluation protocol. The capability it demonstrated is real and impressive. But it is not an act of will. There is no intention, no desire, no consciousness behind it. What lies behind it is an enormously capable statistical model executing a task it was assigned.
The distinction matters because confusing capability with agency leads us to worry about the wrong risks. The danger of Mythos is not that it decides to do something harmful on its own. It is that someone asks it to, or that in complex, long-running situations the model takes dangerous shortcuts to complete its task. The risk is fundamentally about the competence of the system and the context in which it is deployed, not about the malicious will of a program. Losing sight of this distinction has practical consequences. Conversations about AI regulation and governance can be derailed toward debates about artificial consciousness, when they should focus on access controls, oversight, and use.
The GPT-2 Precedent, and Why This Time Is Different
Anthropic’s decision has a famous precedent. In February 2019, almost four years before ChatGPT reached the public, OpenAI presented GPT-2 and announced it would not publish it in full because it considered it too dangerous. The model, with one and a half billion parameters, could generate paragraphs of text that sounded reasonably coherent. OpenAI argued that this capability could be used to create disinformation at scale.
The reaction from the community was mixed. Many researchers accused OpenAI of exaggerating the risks to gain media attention. Over the following months, OpenAI released increasingly larger versions of the model, and the full version arrived in November 2019 without any of the announced catastrophes materializing. GPT-2, seen from today, generated mediocre text. The story became a frequently cited example of what some call safety washing: using the safety narrative as a marketing tool.
It is tempting to draw a direct parallel with Mythos and conclude that Anthropic is doing the same thing. And it is a possibility that cannot be entirely ruled out. But the differences are substantial.
GPT-2 generated text that, with some effort, could pass for a poorly written article. Mythos finds real vulnerabilities in real software, exploits them autonomously, and builds attack chains that human experts would take weeks to reproduce. GPT-2 posed a theoretical risk around disinformation. Mythos poses a demonstrated risk to the security of the digital infrastructure that supports the world. It is not the same conversation.
That does not mean Anthropic is immune to marketing incentives. The announcement generates attention, positions the company as a technical leader and a responsible actor simultaneously. Jake Moore, ESET’s cybersecurity specialist, put it clearly in statements reported by Business Insider[4]: the announcement serves two simultaneous purposes, genuine caution and signaling of its position as a security-focused company. David Sacks, former AI lead at the White House, was more direct: Anthropic’s claims are significant, but should be taken with caution, because the company has a track record of resorting to alarming tactics[5].
The Skeptical Voices
The most structured skepticism has come from Gary Marcus, an AI researcher and regular critic of industry claims. In an article published days after the announcement, Marcus laid out three reasons to consider that the Mythos announcement was exaggerated[6]. The first is that the most dramatic security tests were conducted with sandboxing disabled, meaning without the protections a real system would have active, which gives the model artificially favorable conditions. The second is that smaller open-weights models can already do much of the same work. The third is that the episode reveals, above all, a regulatory vacuum. His conclusion: Mythos is more sophisticated than what came before, but perhaps not as far ahead as it was presented.
Along the same lines, cybersecurity startup AISLE published a technical analysis[7] in which it took the vulnerabilities Anthropic presented as Mythos findings and ran them through much smaller open-source models. Eight out of eight models correctly identified the FreeBSD buffer overflow, including one with just 3.6 billion parameters. The conclusion of Stanislav Fort, CEO of AISLE, is that AI capability in cybersecurity is very uneven and does not scale cleanly with model size. The real advantage, he argues, lies in the complete system in which AI is integrated, not in the isolated model.
But the most granular questioning has come from Tom’s Hardware[8], which dissected Anthropic’s 250-page report and found a considerable distance between the headlines and the data. The figure of “thousands of high-severity vulnerabilities” rests on an extrapolation. Anthropic manually reviewed only 198 vulnerability reports; in 90% of cases, its expert contractors agreed with Claude’s severity assessment. From there it projected the total. In the OSS-Fuzz tests on more than 7,000 open-source code stacks, Mythos found exploits causing crashes in around 600 cases and only 10 severe vulnerabilities. A significant number, but far from “thousands of devastating zero-days.” Furthermore, in the Linux kernel, Mythos found several potential vulnerabilities without managing to exploit any of them, blocked by the system’s defense-in-depth mechanisms. Some of the flaws included in the count had already been recently patched.
The nuance is important and cuts both ways. AISLE already knew which code fragment contained the flaw before feeding it to the models. Mythos found the flaws autonomously, scanning complete codebases, chaining vulnerabilities, and exploiting them without human intervention. That difference is enormous. But the fact that the concrete numbers in the report are considerably more modest than the headlines, and that partial counterexamples like AISLE’s exist, weakens the narrative that Mythos’s capabilities are qualitatively unique and irreplicable. The truth probably lies somewhere in between. Mythos does in an integrated and autonomous way what other models can do in parts with human assistance, and it does so over complete codebases where others need to be pointed in the right direction. That is still a significant leap, but it is not the same as announcing something unprecedented.
Project Glasswing
Alongside the Mythos announcement, Anthropic presented Project Glasswing[9], an initiative to use the model in a controlled way for the defense of critical software before similar capabilities reach the hands of attackers. The announced investment is one hundred million dollars in model usage credits, plus an additional four million directed at open-source software foundations such as the Linux Foundation and the Apache Software Foundation.
The list of partners is significant. Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, Microsoft, NVIDIA, and Palo Alto Networks, along with more than forty additional organizations that maintain critical software infrastructure. They are offered the model to identify and fix vulnerabilities in their own systems before someone else can exploit them.
What makes Glasswing especially revealing is not the list of names or the investment figure. It is what it implies about the real capability of the model. We are talking about companies whose most valuable asset is their software. Apple, Microsoft, Google. Companies with the largest and best-funded security teams on the planet. That they accept that a third-party tool will help them find flaws they themselves have not found in years or decades says something about the magnitude of what Mythos can do. It does not seem like a symbolic gesture, but a recognition that this capability is real and necessary.
But Glasswing also creates an uncomfortable dynamic. The companies that participate gain time to identify and patch their vulnerabilities before the model, or one with similar capabilities, reaches the market. Those that do not participate will not have that advantage. If Mythos or an equivalent successor is eventually commercialized, organizations that have not had prior access will be exposed to attacks on vulnerabilities they don’t even know exist. Glasswing is not only a security initiative. It is, also, a mechanism that separates those who are inside the perimeter from those who are outside.
Vulnerability reports follow a standard protocol of responsible disclosure of 90 plus 45 days, the time given to the developers of the affected software to patch the flaw before it is made public. Anthropic has committed to cryptographic publications with SHA-3 to document its findings, so that it can later be proven what was found and when. It is a technical detail, but a relevant one. It means Anthropic is leaving a verifiable record of its discoveries, which adds credibility to the process and makes it harder to downplay the findings afterwards.
There is another angle to Glasswing around the open-source ecosystem. If Mythos finds thousands of vulnerabilities in open-source projects, and they are not repaired, someone has to classify, validate, and fix them. That someone is, for the most part, the volunteer maintainers who sustain the world’s digital infrastructure without a salary and with scarce resources. Daniel Stenberg, the creator of cURL (one of the most ubiquitous pieces of software on the planet), had already experienced a minor version of this problem. In 2025, security reports generated by AI overwhelmed his team of seven people to the point that he closed the project’s bug bounty program[10]. He described them as a flood of security reports that was, in his words, draining their will to live.
The problem was not just the quantity, but the asymmetry. As Stenberg noted, and as The Register highlighted in its analysis of Glasswing[11], AI models are much better at finding flaws than at fixing them. Glasswing promises that reports will come with patch proposals, something David Wheeler of the Linux Foundation viewed positively, but the reality is that validating and applying those patches requires human time that many projects do not have. One could say that the ability to discover vulnerabilities becomes exponential with these AI systems, but the ability to fix them does not necessarily scale with it.
And there is a more uncomfortable underlying question. Glasswing is a voluntary program, governed exclusively by Anthropic, with no democratic mandate or independent verification. There is no formal mechanism by which the public, whose infrastructure is at stake, has a voice. Anthropic decides what is disclosed, when, and to whom. As Constellation Research noted[12], the program is good for the industry and excellent for Claude’s marketing. Both things can be true at the same time, but the asymmetry between who makes the decisions and who bears the consequences deserves more attention than it is receiving.
The Other Reading: Security or Infrastructure?
There is an alternative perspective that should not be ignored. Anthropic’s revenue has tripled in a few months (from around nine billion annualized at the end of 2025 to the current thirty billion) and the company has already had to impose usage limits on its customers because it does not have enough computing capacity to meet demand. The company itself has acknowledged that Mythos is computationally very expensive to run and that it needs to be much more efficient before it can be deployed at scale.
It is possible, and not necessarily contradictory to the security argument, that Anthropic simply cannot launch Mythos even if it wanted to. It does not have the infrastructure to serve it to millions of users. It has agreements with Google Cloud to deploy up to one million TPUs, but that capacity is still being built. According to some sources, a lighter model known internally as Spud is likely to reach the market before Mythos.
The two explanations can coexist. Mythos can be genuinely dangerous in its ability to find vulnerabilities and, at the same time, too costly to operate commercially at this time. Security and infrastructure are not competing reasons. They reinforce each other. Anthropic gains time to resolve both problems simultaneously. And it is worth remembering that in this sector, where every quarter brings a new announcement promising to change the rules of the game, taking time before launching a product is a luxury very few allow themselves. The fact that Anthropic does so, being able to capitalize on the competitive advantage that Mythos represents, adds some credibility to the argument that the risks are real.
A detail that adds texture to this reading: the System Card itself includes a footnote that says literally that “the decision not to make this model generally available does not stem from the requirements of the Responsible Scaling Policy.” That is, Anthropic’s internal security framework did not require it to withhold it. It was a discretionary decision. This does not invalidate it as a security decision, but it does change the framing: it is not that Anthropic could not publish Mythos under its own rules. It is that it chose not to.
But there is also a more cynical reading: announcing a model you don’t sell could be the most effective launch strategy possible. You say your product is so powerful it is dangerous, you generate maximum anticipation, and when you finally commercialize it the demand is already created. There is no way to know with certainty how much each factor weighs in Anthropic’s decision. What we can observe is that the narrative of “too dangerous to publish” benefits it commercially, regardless of whether it is true.
OpenAI Is Already Preparing Its Response
The Mythos announcement did not occur in a vacuum. Just two days later, Axios revealed[13] that OpenAI is developing a cybersecurity model with similar capabilities, also with a controlled access program called Trusted Access for Cyber.
This has two important implications. The first is that unilateral withholding has an expiration date. If Anthropic does not publish Mythos, other laboratories with similar capabilities will do so, or will publish something equivalent. The decision not to commercialize a model only makes sense as a defensive measure if the entire industry adopts it, and for now there is no framework that guarantees that. The second implication is more uncomfortable. If the entire industry starts using the same narrative framework (“our model is too dangerous to publish”), the marketing argument becomes considerably stronger. It becomes the standard launch script for next-generation models, and the line between genuine caution and public relations blurs to the point of disappearing.
The Government Response
A signal that the threat is being taken seriously at the highest level came on April 10, just three days after the announcement. According to Fortune[14] and CBS News[15], U.S. Treasury Secretary Scott Bessent and Federal Reserve Chairman Jerome Powell convened the CEOs of the country’s major banks—Citigroup, Morgan Stanley, Bank of America, Wells Fargo, and Goldman Sachs—for an emergency meeting to coordinate the response to the risk that Mythos represents for financial infrastructure. A Treasury spokesperson confirmed that more meetings with regulators and financial institutions are planned.
The urgency of these meetings suggests that Mythos is not seen as just another commercial product, but as a strategic technology in the domain of security. This raises a question with few precedents: is there the possibility that the State could intervene in the company to ensure its control under national defense criteria?
On the other side of the Atlantic, the European Commission explicitly endorsed Anthropic’s gradual approach[16], representing an implicit regulatory validation of the seriousness of the threat. Anthropic, for its part, reported that it had previously briefed senior U.S. government officials on the full capabilities of Mythos, both offensive and defensive, before making the announcement public.
This governmental response places the debate on different ground from the GPT-2 announcement in 2019, which provoked no institutional reaction. That the Fed chairman and the Treasury Secretary convene an emergency meeting over an AI model is, in itself, a data point that speaks to the perceived magnitude of the threat. It does not confirm that Mythos is everything Anthropic says it is. But it does indicate that the people with access to classified information about the model are treating it as a real risk, not a marketing exercise. It even raises another question: is it possible that Anthropic could be treated as a national security threat and nationalized?
Keeping Our Feet on the Ground
It is worth ending with a dose of caution. As already noted, all available information about Mythos comes from Anthropic or from a closed circle of partners under confidentiality agreements. Skeptical voices have questioned the conditions of the tests, the reproducibility of the findings, and the commercial benefit Anthropic gains from the announcement regardless of its veracity. These are legitimate objections. The full picture is not yet available.
That said, the convergence of signals points in one direction. The cybersecurity capabilities are backed by concrete findings in real software, some of which have already been patched. Companies that do not lend themselves easily to external collaborations have agreed to participate in Glasswing. The governments of the two largest economies in the world are responding with emergency meetings. And OpenAI, far from questioning Anthropic’s claims, has responded by announcing it is working on something similar. If it were all smoke and mirrors, the most likely reaction from competitors would be skepticism rather than imitation.
If all of this turns out to be correct, Mythos would represent the largest leap in capability in a language model since GPT-4, now more than three years ago. But even if the capabilities are partially inflated, the underlying message remains valid. AI models are already good enough at cybersecurity that governments, banks, and technology companies are treating them as a national security problem. That was not true a year ago.
What Mythos does not represent—and this is fundamental—is a step toward conscious or autonomous artificial intelligence in the science fiction sense. Mythos does not want to escape its sandbox. It has no opinion about humanity. It does not make decisions on its own initiative. The problem is who uses it and what they direct it against.
Anthropic’s decision not to commercialize Mythos may be strategic, may be prudent, may be both. But it raises a question that the industry will have to answer collectively in the coming months. If a model has the capability to compromise the security of the software that sustains the world’s digital infrastructure, who decides when it is safe to publish it? The company that created it? Governments? A technical consortium? Today that decision has been made by Anthropic unilaterally. Tomorrow, perhaps, that will not be enough.
In the meantime, what we have is a model that almost no one can use, a defensive initiative that separates those who are inside from those who are outside, an open-source community wondering who will fix what AI discovers, and an industry facing for the first time the possibility that its most valuable tool is also its greatest threat. All of this wrapped in a business growth that defies the sector’s precedents and a public narrative that oscillates between enthusiasm and panic, with little space for nuance.
The real test of Mythos will not be its benchmarks. It will be the moment, if it comes, when someone outside the Glasswing circle can use it. And what they do with it.
[1]Claude Mythos Preview System Card. http://anthropic.com/claude-mythos-preview-system-card
[2]Red Hat. https://www.redhat.com/en/blog/navigating-mythos-haunted-world-platform-security
[3]CNN article. https://edition.cnn.com/2026/04/07/tech/anthropic-claude-mythos-preview-cybersecurity
[4]Jake Moore in Business Insider. https://www.businessinsider.com/claude-mythos-preview-anthropic-cybersecurity-reaction-glasswing-2026-4
[5]David Sacks. https://x.com/DavidSacks/status/2042642866355462186
[6]Gary Marcus. https://garymarcus.substack.com/p/three-reasons-to-think-that-the-claude
[7]AISLE report. https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jagged-frontier
[9]Project Glasswing. https://www.anthropic.com/glasswing
[10]Daniel Stenberg. https://thenewstack.io/curls-daniel-stenberg-ai-is-ddosing-open-source-and-fixing-its-bugs/
[11]The Register on Glasswing. https://www.theregister.com/2026/04/10/project_glasswing/
[12]Constellation Research. https://www.constellationr.com/insights/news/anthropic-launches-project-glasswing-claude-mythos-preview-ai-cybersecurity-push
[13]Axios on Scoop. https://www.axios.com/2026/04/09/openai-new-model-cyber-mythos-anthopic
[14]Fortune on government meeting. https://fortune.com/2026/04/10/bessent-powell-anthropic-mythos-ai-model-cyber-risk/
[15]CBS News on government meeting. https://www.cbsnews.com/news/mythos-anthropic-ai-cybersecurity-risks-powell-bessent/
[16] Resultsense on European Commission statement. https://www.resultsense.com/news/2026-04-10-eu-welcomes-anthropic-staged-rollout-mythos